Preflight Checklist

• I have read the Contributing Guidelines for this project.
• I agree to follow the Code of Conduct that this project adheres to.
• I have searched the issue tracker for a f

I don't think we currently error if the user specifices a content-length header and then writes more bytes to the response. I think this is something we could detect and error. Some http clients have a hard time handling this case (especially with pipelining) and would be nice if we could help with reducing the probability of this occuring.

npm-bcrypt package is only used in accounts-password and internally it falls back to bcryptjs which hasn't been updated in a while. So wouldn't it be better if we simply added a new npm dependency to accounts-password with bcrypt and deprecated

Describe the bug
Using xframe ALLOW-FROM throws error in console: Invalid 'X-Frame-Options' header encountered when loading 'https://api.dev.mysite.com/uploads/my-file.pdf': 'ALLOW-FROM dev.mysite.com' is not a recognized directive. The header will be ignored.

https://strapi.io/documentation/v3.x/concepts/middlewares.html#response-middlewares
instructions for xframe indicate `ALLOW-FR

While I try to change header titles by passing array of titles to options like below it does not override the headers. Instead it writes new headers first and original data with old headers again from next cell.

I am experiencing the same problem.

In addition, sheets js is mutating the header array passed in, which is not something I would ever expect.

Example:

const head